What are common pitfalls when using mysqli_query and INSERT INTO in PHP?

One common pitfall when using mysqli_query and INSERT INTO in PHP is not properly sanitizing user input, which can lead to SQL injection attacks. To prevent this, it is recommended to use prepared statements with parameterized queries. This helps to separate the SQL logic from the data being passed into the query, making it safer and more secure. 

// Example of using prepared statements with mysqli_query and INSERT INTO

// Establish a database connection
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare the SQL statement with placeholders
$stmt = $mysqli->prepare("INSERT INTO table_name (column1, column2) VALUES (?, ?)");

// Bind parameters to the placeholders
$stmt->bind_param("ss", $value1, $value2);

// Set parameter values
$value1 = "example";
$value2 = "123";

// Execute the statement
$stmt->execute();

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

mysqli_query INSERT INTO SQL injection error handling data validation

Related Questions